English
The Internet threat alert status is currently normal. At present, no major epidemics or other serious incidents have been recorded by Kaspersky Lab’s monitoring service. Internet threat level: 1
Latest posting
By rating
By popularity

Join our blog

You can contribute to our blog if you have +100 points. Comment on articles and blogposts, and other users will rate your comments. You receive points for positive ratings.

0.1
 

    While analyzing suspicious URLs I found out that more and more malicious URLs are coming from .lc domain, which formally belongs to Santa Lucia country located in in the eastern Caribbean Sea.

Our statistics confirm this trend.

Cybercriminals from different places of the world are actively using this domain, including cybercriminals from Brazil abusing free Web hosting available in that country.

How many legitimate domains at .lc zone have you ever had to visit in your life? If the answer is zero, so maybe it’s time to start filtering access to this domain, especially on the corporate Firewall / Proxy layer.

Follow me @dimitribest

Comment      Link
0.2
 

As we published last year, the first Internationalized domain names (IDN) using non-Latin characters appeared on the internet; these contain characters from Cyrillic, Arabic and other languages. We also started to see some news domains using diacritics such as “à, á, â, ã, é, ê, í, ó, ô, õ, ò, ú, ü, ç” in their names, or accents, for instance as seen in http://amarylliscomunicação.com.br.

It’s also important to point that some browsers and mail readers aren’t prepared to show these characters correctly. A domain in Arabic such as http://وزارة-الأتصالات.مصر/ might be shown as http://xn--4gbrim.xn----ymcbaaajlc6dj7bxne2c.xn--wgbh1c in your mailbox. We call this alternate way to show non-latin characters punycode.

During our regular monitoring of malicious activities in Brazil, we discovered an interesting and legitimate URL shortener service which is using the diacritics “ó.ò” in his name:

Webcasts|Whitelisting - how it protects us

Dennis
Kaspersky Lab Expert
Posted August 13, 15:21  GMT
Tags: Content Filtering, Whitelisting
0.1
 

Malware writers are inventing new attacks regularly - but the anti-virus industry invents new protection techniques just as regularly. Whitelisting is on of the newer protection technology which are now standard in Internet Security products. It sounds positive, but how does it actually work? Does it overload your computer? How can developers whitelist their programs? Will whitelisting replace other protection technologies?

Join Andrey Nikishin, Director of Cloud and Content Technology Research, Vladimir Zapolyansky, Manager of Whitlelisting and myself as we discuss how whitelisting itself works. We will also discuss how software writers can join our program and what the benefits are for them.

comments      Link

Incidents|Hot Fail On SexBoosters

Michael
Kaspersky Lab Expert
Posted July 08, 14:27  GMT
Tags: Website Hacks, Content Filtering, Spammer techniques
0.3
 

Over the last couple of days we've been noticing a few pharmacy spam mails which are a bit different. Somebody seems to have replaced the original graphical content with an alert highlighting that such messages are malicious.

So far we have counted three (ab)used image hosting services for this spam:

  1. imageshack.us
  2. imgur.com
  3. myimg.de

A quick analysis of these showed that #1 currently serves all the replaced images, #2 serves all original spammers images and #3 seems to have removed the offensive content immediately, good work!

At the moment, we don't have any further information about the source/background of the warning replacements - this gives us plenty of opportunity to use our imaginations when thinking about what's actually going on. A few of the key words and concepts we're considering are: white hats, rival spammers, compromised hosting service(s). Not an exhaustive list, but more of a launch pad for further theories and research!

comments      Link
0.1
 

Yesterday, May 14 we saw the first new Cyrillic domains available on the Internet for public visiting. One of those domains is the official site of the President of Russia, Dmitry Medvedev http://президент.рф


Prior to seeing the Cyrillic language domains, we have also seen the first domains in the Arabic language, which are also available for public for all Internet users to see. As an example, the domain: http://وزارة-الأتصالات.مصر


It's good to see that some nations now have their own language domain names. However it brings up some new potential challenges and possibly some problems. All of the countries that are now getting their own language domains have up until now had all of their domains in Latin characters, those domains are easier to decipher for Internet users and users have learned how to distinguish a fake phishing domain from legitimate domains. Unfortunately, it's just a question of time, as to when cyber criminals will start registering phishing domains using the same names; however they will be translated or transliterated into a native local language. It may confuse a lot to ordinary users, which may lead them to become the victim of a cyber crime.

Another problem that may arise is how you can differentiate between a legitimate or a phishing domain if it is in a local language? Imagine if you work in an anti-phishing lab and have to classify messages. That may be very difficult if they are in a local language. Analysts must not present any doubts when classifying a domain as a phishing domain, the mistake may mean that a legitimate domain pays the price.
comments      Link

Opinions|Bluelisting - pros and cons

David
Kaspersky Lab Expert
Posted July 14, 17:47  GMT
Tags: Content Filtering
0
 

I'm sure most of us are familiar with whitelisting. It's the idea of filtering applications (or emails, depending on the context) and allowing only those that are explicitly listed.

Well, what about 'bluelisting', i.e using a database of digital fingerprints to find pornographic content on a drive?

It's easy to see why such a solution might be attractive. It could help parents to shield their children from pornographic content. It could help businesses avoid the HR and legal fallout from the presence of such content on corporate systems and eliminate the hit on corporate bandwidth associated with pornographic downloads. And it could help law enforcement agencies track down those storing illegal images.

However, it seems to me that while such an approach may tell us 'What?' and 'Where?', it does little to tell us 'Who?' and 'How?'; and these are the key questions in a forensic investigation. There have already been several cases of people accused of downloading pornographic content who have claimed that a Trojan was responsible for the download: man cleared of porn charges, trojan responsible for porn and new trial in porn case.

Comment      Link